@crossdelta/platform-sdk 0.26.4 → 0.26.5

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to `@crossdelta/platform-sdk` will be documented in this fil
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.26.5] - 2026-10-23
+
+### Changed
+- **The workspace template's `publish-packages.yml` queues its runs and skips a version npm already
+  holds.** A `concurrency` group (`publish-packages`, no cancelling) stops two merges in a row from
+  publishing the same version at once, and the publish step reads `npm view "<name>@<version>"`
+  right before `npm publish`: a hit ends the step with a skip line, any other failure of `npm view`
+  publishes as before (the read ignores setup-node's placeholder token). On a push the matrix now
+  checks every public package against npm instead of only the changed ones: a queued run can be
+  replaced by a newer one, and the replaced push's version bump would otherwise never publish.
+
 ## [0.26.4] - 2026-10-21
 
 ### Changed

package/bin/templates/workspace/.github/workflows/publish-packages.yml

@@ -16,6 +16,11 @@ on:
         default: all
         required: true
 
+# Runs queue one behind the other: two merges in a row must not publish the same version at once.
+concurrency:
+  group: publish-packages
+  cancel-in-progress: false
+
 # id-token: write only where it is used: the publish job sets it itself.
 permissions:
   contents: read
@@ -32,38 +37,18 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Detect changed packages
-        id: changed
-        uses: tj-actions/changed-files@v47
-        with:
-          json: true
-          safe_output: false
-          files: packages/*/**
-
       - name: Build package matrix
         id: set-matrix
         env:
           INPUT_PACKAGE: ${{ github.event.inputs.package || '' }}
-          CHANGED_FILES: ${{ steps.changed.outputs.all_changed_files }}
         run: |
           declare -a packages=()
-          declare -A changed_packages
 
           # Compare semver: true if $1 > $2
           version_gt() {
             [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -1)" = "$1" ] && [ "$1" != "$2" ]
           }
 
-          # Extract package names from changed file paths (e.g. packages/platform-sdk/src/foo.ts → platform-sdk)
-          if [ "${{ github.event_name }}" == "push" ] && [ -n "$CHANGED_FILES" ]; then
-            CLEAN_FILES=$(echo "$CHANGED_FILES" | sed 's/\\"/"/g')
-            for file in $(echo "$CLEAN_FILES" | jq -r '.[]' 2>/dev/null); do
-              if [[ $file =~ ^packages/([^/]+)/ ]]; then
-                changed_packages["${BASH_REMATCH[1]}"]=1
-              fi
-            done
-          fi
-          
           # Iterate all packages
           for dir in packages/*/; do
             [ ! -f "$dir/package.json" ] && continue
@@ -76,17 +61,13 @@ jobs:
             [ "$is_private" = "true" ] && continue
             [ -z "$name" ] && continue
             
-            # Include package?
-            should_include=false
-            if [ -n "$INPUT_PACKAGE" ]; then
-              [ "$INPUT_PACKAGE" = "all" ] || [ "$INPUT_PACKAGE" = "$slug" ] && should_include=true
-            else
-              [ -n "${changed_packages[$slug]}" ] && should_include=true
+            # A dispatch may name one package; a push checks every public package. A queued run can be
+            # replaced by a newer one, so a changed-files delta would lose the bump of the replaced push.
+            if [ -n "$INPUT_PACKAGE" ] && [ "$INPUT_PACKAGE" != "all" ] && [ "$INPUT_PACKAGE" != "$slug" ]; then
+              continue
             fi
-            
-            [ "$should_include" = true ] || continue
 
-            # Skip if local version <= npm version
+            # Skip if local version <= npm version (this check, not a changed-files filter, selects what publishes)
             local_ver=$(jq -r '.version' "$dir/package.json")
             npm_ver=$(npm view "$name" version 2>/dev/null || echo "0.0.0")
             if ! version_gt "$local_ver" "$npm_ver"; then
@@ -214,7 +195,7 @@ jobs:
       # The kit is published for other people's repositories: nothing of this one may ride along. The check packs
       # the package as npm receives it and scans every text file against the kit's built-in patterns.
       - name: Setup Bun for the leak check
-        if: matrix.package.name == 'jackherd' || matrix.package.name == '@crossdelta/agent-kit'
+        if: matrix.package.name == 'jackherd'
         # Pinned to a commit: this job holds id-token: write, which npm Trusted Publishing accepts.
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
@@ -225,11 +206,6 @@ jobs:
         working-directory: ${{ matrix.package.dir }}
         run: bun scripts/check-package-leaks.ts
 
-      - name: Leak check on the agent-kit shell tarball
-        if: matrix.package.name == '@crossdelta/agent-kit'
-        working-directory: ${{ matrix.package.dir }}
-        run: bun ../jackherd/scripts/check-package-leaks.ts .
-
       - name: Publish to npm
         working-directory: ${{ matrix.package.dir }}
         run: |
@@ -242,6 +218,13 @@ jobs:
               (if .peerDependencies[$n] then .peerDependencies[$n] = $v else . end)
             ' package.json > "$tmp" && mv "$tmp" package.json
           done
+          NAME=$(jq -r '.name' package.json)
           VERSION=$(jq -r '.version' package.json)
-          echo "📦 Publishing ${{ matrix.package.name }}@$VERSION"
+          # Only a hit skips; any other npm view failure (network) falls through to the publish.
+          # Empty NODE_AUTH_TOKEN: setup-node's placeholder token must not turn a public read into a 401.
+          if [ "$(NODE_AUTH_TOKEN= npm view --registry=https://registry.npmjs.org "$NAME@$VERSION" version 2>/dev/null)" = "$VERSION" ]; then
+            echo "⏭️ $NAME@$VERSION is on npm already — skipping"
+            exit 0
+          fi
+          echo "📦 Publishing $NAME@$VERSION"
           npm publish --access=public --ignore-scripts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossdelta/platform-sdk",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "description": "Platform toolkit for event-driven microservices — keeping code and infrastructure in lockstep.",
   "keywords": [
     "cli",